CISSP Security Assessment and Testing Practice Question
During a penetration test, the tester has obtained initial access and is now trying to move laterally to other systems. Which phase of the penetration testing process does this represent?
⚠ Common exam trap
A common mix-up: candidates confuse 'exploitation' (gaining initial access) with 'post-exploitation/lateral movement' (using that access to move to other systems), as candidates often think any active attack step is 'exploitation' without recognizing the sequential phases of a penetration test.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Post-exploitation/lateral movement
The post-exploitation/lateral movement phase occurs after initial access is gained, where the tester uses compromised systems as pivot points to access other network segments, often leveraging tools like PsExec, WMI, or SMB relay to move across hosts. This phase is distinct from exploitation, which focuses on gaining the initial foothold, and reconnaissance, which occurs before any access is obtained.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reconnaissance
Why it's wrong here
Reconnaissance focuses on passive or active information gathering before any exploitation occurs, such as scanning for open ports or enumerating services. The scenario describes a tester who has already obtained initial access and is now moving laterally, which falls under the post-exploitation or lateral movement phase. This option is tempting because reconnaissance is often confused with the entire testing process, and in a scenario where no access has been gained, it would be the correct initial phase.
- ✗
Reporting
Why it's wrong here
Reporting is the formal documentation phase of a penetration test, occurring after all technical activities, including post-exploitation and cleanup, have concluded. It involves compiling findings, identified vulnerabilities, associated risks, and actionable recommendations into a comprehensive report for the client. This phase does not involve active system interaction or movement within the target network, as the technical assessment is already complete.
- ✓
Post-exploitation/lateral movement
Why this is correct
Post-exploitation begins immediately after initial access is successfully gained on a target system. This crucial phase focuses on maintaining access, escalating privileges within the compromised system, gathering sensitive information, and establishing persistence mechanisms. Lateral movement is a key component, involving techniques to pivot from the initial compromised host to other systems within the network, expanding the tester's foothold and access to additional resources to simulate a real-world breach.
- ✗
Exploitation
Why it's wrong here
Exploitation is the process of actively leveraging identified vulnerabilities to gain unauthorized access or control over a target system. This phase involves executing specific exploits against discovered weaknesses to establish an initial foothold, often resulting in remote code execution or shell access. Since the question states the tester "has obtained initial access," the exploitation phase has already been successfully completed, and the tester is now operating beyond that initial breach point.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.